WebKit (CVE-2010-1813) HTML Objects Memory Corruption Vulnerability

Bugtraq ID:	43078
Class:	Unknown
CVE:	CVE-2010-1813
Remote:	Yes
Local:	No
Published:	Sep 08 2010 12:00AM
Updated:	Nov 22 2010 06:36PM
Credit:	Jose A. Vazquez of spa-s3c.blogspot.com
Vulnerable:	Google Chrome 5.0.375.12 Google Chrome 5.0.375.11 Google Chrome 5.0.375.10 Google Chrome 5.0.375.1 Google Chrome 5.0.375.0 Apple Safari 4.1.2 for Windows Apple Safari 4.0.5 for Windows Apple Safari 4.0.5 Apple Safari 4.0.4 for Windows Apple Safari 4.0.4 Apple Safari 4.0.3 for Windows Apple Safari 4.0.3 Apple Safari 4.0.2 for Windows Apple Safari 4.0.2 Apple Safari 4.0.1 Apple Safari 5.0.2 for Windows Apple Safari 5.0.2 Apple Safari 5.0.1 for Windows Apple Safari 5.0.1 Apple Safari 5.0 for Windows Apple Safari 5.0 Apple Safari 4.1.2 Apple Safari 4.1.1 Apple Safari 4.1 Apple Safari 4 for Windows Apple Safari 4 Beta Apple Safari 4 Apple iPod Touch 3.1.3 Apple iPod Touch 3.1.2 Apple iPod Touch 3.1.1 Apple iPod Touch 2.2.1 Apple iPod Touch 2.0.2 Apple iPod Touch 2.0.1 Apple iPod Touch 3.0 Apple iPod Touch 2.2 Apple iPod Touch 2.1 Apple iPod Touch 2.0 Apple iPhone 4.0.1 Apple iPhone 3.2.1 Apple iPhone 3.1.3 Apple iPhone 3.1.2 Apple iPhone 3.0.1 Apple iPhone 2.2.1 Apple iPhone 2.0.2 Apple iPhone 2.0.1 Apple iPhone 4.0.1 - Iphone Apple iPhone 4.0 - Ipodtouch Apple iPhone 4.0 - Iphone Apple iPhone 4.0 Apple iPhone 3.2.1 - Ipad Apple iPhone 3.2 - Ipodtouch Apple iPhone 3.2 - Iphone Apple iPhone 3.2 Apple iPhone 3.1.3 - Ipodtouch Apple iPhone 3.1.3 - Iphone Apple iPhone 3.1.2 - Ipodtouch Apple iPhone 3.1.2 - Iphone Apple iPhone 3.1 - Ipodtouch Apple iPhone 3.1 - Iphone Apple iPhone 3.1 Apple iPhone 3.0.1 - Ipodtouch Apple iPhone 3.0.1 - Iphone Apple iPhone 3.0 - Ipodtouch Apple iPhone 3.0 - Iphone Apple iPhone 3.0 Apple iPhone 2.2.1 - Ipodtouch Apple iPhone 2.2.1 - Iphone Apple iPhone 2.2 - Ipodtouch Apple iPhone 2.2 - Iphone Apple iPhone 2.2 Apple iPhone 2.1 - Ipodtouch Apple iPhone 2.1 - Iphone Apple iPhone 2.1 Apple iPhone 2.0 Apple iPad 3.2.1 Apple iPad 3.2.2 Apple iPad 3.2 Apple iPad 0 Apple iPad 0 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 4.2 beta Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 2.0
Not Vulnerable:	Google Chrome 5.0.375 125 Apple Safari 5.0.3 for Windows Apple Safari 5.0.3 Apple Safari 5.0.2 Apple Safari 4.1.3 for Windows Apple Safari 4.1.3 Apple Safari 4.1.2 Apple iOS 4.2 Apple iOS 4.1

WebKit (CVE-2010-1813) HTML Objects Memory Corruption Vulnerability

Webkit is prone to a memory-corruption vulnerability.

An attacker can exploit this issue by tricking an unsuspecting victim into viewing a web page containing malicious content. Successfully exploiting these issues may allow attackers to crash the affected application or execute arbitrary code.

This issue affects the following:

iOS 2.0 through 4.0.2 for iPhone 3G and later
iOS 2.1 through 4.0.2 for iPod touch (2nd generation) and later
Versions prior to Apple Safari 4.1.2 and 5.0.2
Versions prior to Google Chrome 5.0.375.125

NOTE: This issue was previously discussed in BID 43070 (Apple iPhone/iPod touch Prior to iOS 4.1 Multiple Vulnerabilities) but has been given its own record to better document it.

WebKit (CVE-2010-1813) HTML Objects Memory Corruption Vulnerability

The following proof of concept is available:

• /data/vulnerabilities/exploits/43078.html

WebKit (CVE-2010-1813) HTML Objects Memory Corruption Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.


Apple Safari 5.0.2

• Apple Safari5.0.3SnowLeopard.dmg
  Safari for Mac OS X v10.6.4 and later
  http://www.apple.com/safari/download/


• Apple Safari5.0.3Leopard.dmg
  Safari for Mac OS X v10.5.8
  http://www.apple.com/safari/download/

Apple Safari 4.1.2

• Apple Safari4.1.3Tiger.dmg
  Safari for Mac OS X v10.4.11
  http://www.apple.com/safari/download/

Apple Safari 5.0.2 for Windows

• Apple APPLE-SA-2010-11-18-1Safari_Setup.exe
  Safari for Windows 7, Vista or XP from the Microsoft Choice Screen
  http://www.apple.com/safari/download/


• Apple APPLE-SA-2010-11-18-1SafariSetup.exe
  Safari for Windows 7, Vista or XP
  http://www.apple.com/safari/download/


• Apple APPLE-SA-2010-11-18-1SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows 7, Vista or XP
  http://www.apple.com/safari/download/

Apple Safari 4.1.2 for Windows

• Apple APPLE-SA-2010-11-18-1SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows 7, Vista or XP
  http://www.apple.com/safari/download/


• Apple APPLE-SA-2010-11-18-1Safari_Setup.exe
  Safari for Windows 7, Vista or XP from the Microsoft Choice Screen
  http://www.apple.com/safari/download/


• Apple APPLE-SA-2010-11-18-1SafariSetup.exe
  Safari for Windows 7, Vista or XP
  http://www.apple.com/safari/download/

WebKit (CVE-2010-1813) HTML Objects Memory Corruption Vulnerability

References:

• Apple Safari Homepage (Apple)
  
• Google Chrome 5.0.375.125 has been released to the Stable channel (Google)
  
• Google Chrome Homepage (Google)
  
• iOS 4 Software Update (Apple)
  
• iPhone Product Page (Apple)
  
• iPod touch Product Page (Apple)
  
• Webkit (Apple Safari < 4.1.2/5.0.2 & Google Chrome < 5.0.375.125) Memory Corrupt (JOSE A. VAZQUEZ)